vault-cortex 0.12.0 → 0.13.1

package/README.md

@@ -60,8 +60,8 @@ What it does:
 Re-running init where a setup already exists asks first — declining leaves
 everything unchanged and points you at [`configure`](#configure), the right
 tool for changing settings in place. Existing files are never overwritten
-without asking. During a remote setup, init offers to run
-[`get-sync-token`](#get-sync-token) for you when Docker is available.
+without asking. During a remote setup, init offers to generate your
+[Obsidian Sync token](#get-sync-token) as part of the flow.
 
 Flags:
 
@@ -194,17 +194,15 @@ remote setups — without leaving the CLI:
 npx vault-cortex@latest get-sync-token
 ```
 
-The command opens the Obsidian login inside Docker. Once you've signed in, it
-captures your token and prints it — nothing to dig out of the login output.
-Use `--dir <path>` to write the token straight into an existing `.env`
-instead:
+The command prompts for your Obsidian account email, password, and MFA code
+(if enabled), signs in via the Obsidian API, and prints the token. Use
+`--dir <path>` to write the token straight into an existing `.env` instead:
 
 ```bash
 npx vault-cortex@latest get-sync-token --dir ./vault-cortex
 ```
 
-During `init --mode remote`, this flow is offered automatically when Docker
-is available.
+During `init --mode remote`, this flow is offered automatically.
 
 ## Requirements
 
@@ -218,4 +216,5 @@ is available.
 
 - [Local quickstart](https://github.com/aliasunder/vault-cortex/blob/main/deploy/local/README.md)
 - [Remote quickstart (VPS + Obsidian Sync)](https://github.com/aliasunder/vault-cortex/blob/main/deploy/remote/README.md)
+- [One-click deploy on Render or Railway](https://github.com/aliasunder/vault-cortex#one-click-deploy)
 - [Full project README](https://github.com/aliasunder/vault-cortex)

package/dist/docker.js

@@ -2,36 +2,6 @@ import { spawn, spawnSync } from "node:child_process";
 export const LOCAL_IMAGE = "ghcr.io/aliasunder/vault-cortex:latest";
 export const REMOTE_IMAGE = "ghcr.io/aliasunder/vault-cortex:remote";
 export const CONTAINER_NAME = "vault-cortex";
-/**
- * Builds the `docker run` args for the Obsidian login with a volume mount
- * that captures the auth token file. Runs `ob login` directly instead of
- * the image's get-sync-token script: the script's additions are locating and
- * printing the token, and the mount makes both unnecessary — the CLI reads
- * the token file itself, and not echoing a credential keeps it out of
- * terminal scrollback. Pure function for testability.
- *
- * On Linux, includes `--user uid:gid` when uid/gid are provided — Node
- * exposes process.getuid/getgid on every POSIX platform, so in practice the
- * flag is always set there — keeping the token file host-user-owned. macOS
- * Docker Desktop translates UIDs automatically, so no flag is needed.
- */
-export const buildObsidianLoginArgs = (params) => {
-    const { configMountPath, platform = process.platform, uid, gid } = params;
-    const args = [
-        "run",
-        "--rm",
-        "-it",
-        "--entrypoint",
-        "ob",
-        "-v",
-        `${configMountPath}:/home/obsidian/.config`,
-    ];
-    if (platform === "linux" && uid !== undefined && gid !== undefined) {
-        args.push("--user", `${uid}:${gid}`);
-    }
-    args.push(REMOTE_IMAGE, "login");
-    return args;
-};
 /**
  * Container-internal env vars that must override the user's .env values.
  * VAULT_PATH in .env is the host path (for the -v mount); the container
@@ -130,10 +100,7 @@ export const createDockerRunner = () => ({
     // stdout is discarded: `docker run -d` prints only the container ID there,
     // which lands as a raw hex line between the wizard's prompts. stderr stays
     // inherited — image-pull progress and error output print live, which the
-    // "see output above" failure messages rely on. stdin is ignored on purpose:
-    // buildDockerRunArgs always runs detached (never -it), and the prompt
-    // library owns the terminal's stdin — interactive flows go through
-    // runObsidianLogin, which inherits all three streams.
+    // "see output above" failure messages rely on.
     dockerRun: (params) => spawnSync("docker", buildDockerRunArgs(params), {
         stdio: ["ignore", "ignore", "inherit"],
     }).status === 0,
@@ -166,11 +133,6 @@ export const createDockerRunner = () => ({
         // convention for ctrl-C (128 + SIGINT = 130).
         child.once("close", (code) => resolveExitCode(code ?? 130));
     }),
-    runObsidianLogin: (configMountPath) => spawnSync("docker", buildObsidianLoginArgs({
-        configMountPath,
-        uid: process.getuid?.(),
-        gid: process.getgid?.(),
-    }), { stdio: "inherit" }).status === 0,
 });
 /** Default bound on a single health request (shared by probe and poll). */
 const PROBE_TIMEOUT_MS = 10_000;

package/dist/env.js

@@ -15,7 +15,7 @@ const LOCAL_OPTIONAL_BLOCK = `# Optional ─────────────
 # "npx vault-cortex@latest restart" (plain docker restart does not
 # re-read this file).
 
-# Public URL for OAuth issuer URL in discovery metadata (default: http://localhost:8000).
+# Public URL for OAuth issuer and access-token binding (default: http://localhost:8000).
 # Override if you expose the server on a different URL (e.g. via a reverse proxy).
 PUBLIC_URL=http://localhost:8000
 
@@ -77,9 +77,10 @@ MEMORY_DIR=About Me
 # DAILY_NOTES_FOLDER=Journal
 # DAILY_NOTES_FORMAT=YYYY-MM-DD
 
-# Comma-separated folders protected from deletion (default: MEMORY_DIR plus
-# the daily notes folder — DAILY_NOTES_FOLDER when set, otherwise "Daily Notes").
-# A custom folder set only in daily-notes.json is not auto-protected.
+# Comma-separated folders protected from deletion and moves. Default: MEMORY_DIR plus
+# the daily notes folder, read from DAILY_NOTES_FOLDER or .obsidian/daily-notes.json
+# (default "Daily Notes"). When set, replaces the whole default — include the
+# daily notes folder in your list if needed.
 # PROTECTED_PATHS=About Me,Daily Notes
 
 # Comma-separated folders excluded from orphan detection (default: the daily
@@ -215,9 +216,10 @@ MEMORY_DIR=About Me
 # DAILY_NOTES_FOLDER=Journal
 # DAILY_NOTES_FORMAT=YYYY-MM-DD
 
-# Comma-separated folders protected from deletion (default: MEMORY_DIR plus
-# the daily notes folder — DAILY_NOTES_FOLDER when set, otherwise "Daily Notes").
-# A custom folder set only in daily-notes.json is not auto-protected.
+# Comma-separated folders protected from deletion and moves. Default: MEMORY_DIR plus
+# the daily notes folder, read from DAILY_NOTES_FOLDER or .obsidian/daily-notes.json
+# (default "Daily Notes"). When set, replaces the whole default — include the
+# daily notes folder in your list if needed.
 # PROTECTED_PATHS=About Me,Daily Notes
 
 # Comma-separated folders excluded from orphan detection (default: the daily
@@ -324,11 +326,11 @@ export const buildRemoteEnv = (answers) => {
 # VAULT_PASSWORD=`
         : `# Vault end-to-end encryption password.
 VAULT_PASSWORD=${answers.vaultPassword}`;
-    const obsidianTokenComment = answers.obsidianAuthToken === ""
-        ? `# Obsidian Sync auth token — FILL THIS IN before starting the server.
+    const obsidianTokenComment = answers.obsidianAuthToken
+        ? `# Obsidian Sync auth token.`
+        : `# Obsidian Sync auth token — FILL THIS IN before starting the server.
 # Generate once with:
-#   npx vault-cortex@latest get-sync-token`
-        : `# Obsidian Sync auth token.`;
+#   npx vault-cortex@latest get-sync-token`;
     return `# vault-cortex — remote quickstart (Obsidian Sync)
 # Generated by \`npx vault-cortex@latest init\`. Full option reference:
 # https://github.com/aliasunder/vault-cortex/blob/main/deploy/remote/.env.example
@@ -339,11 +341,12 @@ VAULT_PASSWORD=${answers.vaultPassword}`;
 MCP_AUTH_TOKEN=${answers.mcpAuthToken}
 
 # Public URL that MCP clients use to reach this server.
-# Used as the OAuth issuer URL in discovery metadata.
+# Used as the OAuth issuer URL in discovery metadata and stamped on every
+# access token; changing it invalidates connected clients' tokens.
 PUBLIC_URL=${answers.publicUrl}
 
 ${obsidianTokenComment}
-OBSIDIAN_AUTH_TOKEN=${answers.obsidianAuthToken}
+OBSIDIAN_AUTH_TOKEN=${answers.obsidianAuthToken ?? ""}
 
 # Exact name of your Obsidian vault (case-sensitive).
 VAULT_NAME=${answers.vaultName}

package/dist/get-sync-token.js

@@ -1,140 +1,127 @@
-import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
-import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, } from "./messages.js";
 import { patchEnvObsidianToken } from "./scaffold.js";
 import { expandTilde } from "./vault.js";
-/** Message from an unknown throw — Error instances keep their message. */
+const OBSIDIAN_SIGNIN_URL = process.env.OBSIDIAN_SIGNIN_URL ?? "https://api.obsidian.md/user/signin";
+const SIGNIN_TIMEOUT_MS = 30_000;
 const describeError = (error) => error instanceof Error ? error.message : String(error);
-/**
- * Creates the temp dir the container's config mount writes into.
- * Returns undefined (after warning) when creation fails.
- */
-const makeTempMountDir = (prompts) => {
-    try {
-        return mkdtempSync(join(tmpdir(), "vault-cortex-sync-token-"));
+class ObsidianApiError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ObsidianApiError";
     }
-    catch (error) {
-        prompts.warn(`Could not create a temp directory for token capture — ${describeError(error)}`);
-        return undefined;
-    }
-};
+}
+const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
- * Runs the interactive Obsidian login container. A throw from the Docker
- * runner is reported and treated the same as a non-zero exit.
+ * Calls the Obsidian Sync signin API. Returns the parsed JSON on success,
+ * or throws on HTTP/network errors. The API returns { error: string } for
+ * auth failures (200 with an error field), and non-200 for server errors.
  */
-const runLoginContainer = (configMountPath, deps) => {
-    const { docker, prompts } = deps;
+const callSigninApi = async (params, fetchFn) => {
+    const response = await fetchFn(OBSIDIAN_SIGNIN_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Origin: "https://obsidian.md",
+        },
+        body: JSON.stringify({
+            email: params.email,
+            password: params.password,
+            mfa: params.mfa,
+        }),
+        signal: AbortSignal.timeout(SIGNIN_TIMEOUT_MS),
+    });
+    if (!response.ok)
+        throw new Error(`HTTP Error ${response.status}`);
     try {
-        return docker.runObsidianLogin(configMountPath);
+        const body = await response.json();
+        if (!isJsonObject(body))
+            throw new Error("not a JSON object");
+        if (typeof body.error === "string")
+            throw new ObsidianApiError(body.error);
+        if (typeof body.token !== "string" || !body.token)
+            throw new Error("no token field");
+        return body.token;
     }
     catch (error) {
-        prompts.warn(`Docker run failed — ${describeError(error)}`);
-        return false;
+        if (error instanceof ObsidianApiError)
+            throw error;
+        throw new Error(`Unexpected response from Obsidian API (${describeError(error)})`, { cause: error });
     }
 };
 /**
- * Reads the captured token file from the config mount. Returns undefined
- * when the file is missing, empty, or unreadable — the caller treats all
- * three as "no token captured".
+ * Warns the user about a signin failure with a message tailored to the
+ * error type. Called by both the initial signin and MFA retry paths.
  */
-const readCapturedTokenFile = (configMountPath) => {
-    const tokenPath = join(configMountPath, "obsidian-headless", "auth_token");
-    try {
-        if (!existsSync(tokenPath))
-            return undefined;
-        const token = readFileSync(tokenPath, "utf8").trim();
-        return token || undefined;
-    }
-    catch {
-        return undefined;
+const warnSigninError = (error, prompts, isMfaRetry) => {
+    if (error instanceof Error && error.name === "TimeoutError") {
+        prompts.warn("Request timed out — check your internet connection and try again.");
+        return;
     }
+    const isMfaError = error instanceof ObsidianApiError && error.message.includes("2FA code");
+    const mfaHint = isMfaRetry && isMfaError ? "\n  Check your 2FA code and try again." : "";
+    prompts.warn(`Could not sign in: ${describeError(error)}${mfaHint}`);
 };
 /**
- * Best-effort removal of the temp mount dir. Failing to remove it (e.g.
- * root-owned files left by the container) must not turn a successful
- * capture into a failure, so it warns instead of throwing.
+ * Signs in to the user's Obsidian account via the Sync API and returns
+ * the auth token. Prompts for email, password, and MFA code (when 2FA
+ * is enabled). Returns the token on success, undefined on any failure.
  */
-const removeTempMountDir = (configMountPath, prompts) => {
+export const captureObsidianToken = async (deps) => {
+    const { prompts, fetchFn } = deps;
+    const email = await prompts.text("Obsidian account email:", {
+        placeholder: "you@example.com",
+    });
+    const password = await prompts.password("Password:");
+    const spinner = prompts.spinner();
+    spinner.start("Signing in to Obsidian...");
     try {
-        rmSync(configMountPath, { recursive: true, force: true });
+        const token = await callSigninApi({ email, password, mfa: "" }, fetchFn);
+        spinner.stop(`Signed in as ${email}.`);
+        return token;
     }
     catch (error) {
-        prompts.warn(`Could not remove temp directory ${configMountPath} — ${describeError(error)}`);
-    }
-};
-/**
- * Runs the Obsidian login (`ob login`) inside a Docker container with a
- * volume mount that captures the auth token file. The interactive login
- * (email, password, MFA) shows in the terminal, but the resulting token is
- * read from the mounted config dir — never printed, so it stays out of
- * terminal scrollback.
- *
- * tokenDestinationMessage finishes the handoff message by telling the user
- * where the captured token ends up — the destination differs per flow
- * (init stores it in the generated .env; the subcommand prints it, or
- * writes it to an existing .env with --dir).
- *
- * Returns the token string on success, undefined on any failure — each
- * fallible operation is wrapped individually by the helpers above, so no
- * catch-all is needed here. The bare try/finally only scopes the temp dir
- * (acquire → release); it has no catch and swallows nothing.
- */
-export const captureObsidianToken = (deps, tokenDestinationMessage) => {
-    const { prompts } = deps;
-    const configMountPath = makeTempMountDir(prompts);
-    if (!configMountPath)
-        return undefined;
-    try {
-        prompts.log("Handing the terminal to the Obsidian login — it will ask for your " +
-            `account email, password, and MFA code. ${tokenDestinationMessage}`);
-        const loginSucceeded = runLoginContainer(configMountPath, deps);
-        if (!loginSucceeded) {
-            prompts.warn("The Obsidian login did not complete — you can run it later with:\n" +
-                "  npx vault-cortex@latest get-sync-token");
+        // MFA required: the API returns an error containing "2FA code" — prompt
+        // and retry. "2FA code is incorrect" is a wrong-code rejection, not a
+        // prompt-for-code signal. Mirrors the obsidian-headless v0.0.14 logic.
+        const needsMfa = error instanceof ObsidianApiError &&
+            error.message.includes("2FA code") &&
+            !error.message.includes("2FA code is incorrect");
+        if (!needsMfa) {
+            spinner.stop("Sign-in failed.");
+            warnSigninError(error, prompts, false);
             return undefined;
         }
-        const token = readCapturedTokenFile(configMountPath);
-        if (!token) {
-            prompts.warn("The Obsidian login finished, but no token was captured — the " +
-                "token file was missing, empty, or unreadable. You can retry with:\n" +
-                "  npx vault-cortex@latest get-sync-token");
+        spinner.stop("Two-factor authentication required.");
+        const mfaCode = await prompts.text("2FA code:");
+        spinner.start("Verifying...");
+        try {
+            const token = await callSigninApi({ email, password, mfa: mfaCode }, fetchFn);
+            spinner.stop(`Signed in as ${email}.`);
+            return token;
+        }
+        catch (retryError) {
+            spinner.stop("Sign-in failed.");
+            warnSigninError(retryError, prompts, true);
             return undefined;
         }
-        return token;
-    }
-    finally {
-        removeTempMountDir(configMountPath, prompts);
     }
 };
 /**
- * Subcommand entry: generate an Obsidian Sync token via Docker.
+ * Subcommand entry: generate an Obsidian Sync token via the Obsidian API.
  * Without --dir, prints the token to stdout.
  * With --dir, writes it directly to `<dir>/.env`.
  */
 export const runGetSyncToken = async (flags, deps) => {
-    const { prompts, docker } = deps;
-    const daemonStatus = docker.daemonStatus();
-    if (daemonStatus !== "running") {
-        prompts.error(daemonStatus === "not-installed"
-            ? buildDockerNotInstalledMessage({ nextStep: "\nThen try again." })
-            : buildDaemonNotRunningMessage(" and try again."));
-        return 1;
-    }
+    const { prompts } = deps;
     prompts.intro("vault-cortex get-sync-token");
-    // Resolve the destination up front so the login handoff message can tell
-    // the user where the token will end up.
-    const envFilePath = flags.dir
-        ? join(resolve(expandTilde(flags.dir)), ".env")
-        : undefined;
-    const tokenDestinationMessage = envFilePath
-        ? `The token is captured automatically and written to ${envFilePath}.`
-        : "The token is captured automatically and printed at the end.";
-    const token = captureObsidianToken({ docker, prompts }, tokenDestinationMessage);
+    const token = await captureObsidianToken(deps);
     if (!token) {
         prompts.error("Could not capture the auth token.");
         return 1;
     }
+    const envFilePath = flags.dir
+        ? join(resolve(expandTilde(flags.dir)), ".env")
+        : undefined;
     if (!envFilePath) {
         prompts.log("Your OBSIDIAN_AUTH_TOKEN:");
         prompts.print(`\n  ${token}\n`);
@@ -147,7 +134,8 @@ export const runGetSyncToken = async (flags, deps) => {
             "OBSIDIAN_AUTH_TOKEN line. Run init first.");
         return 1;
     }
-    prompts.log(`Token written to ${envFilePath}`);
+    prompts.log(`Token written to ${envFilePath}\n\n` +
+        `Start the server:\n  npx vault-cortex start --dir "${flags.dir}"`);
     prompts.outro("Done.");
     return 0;
 };

package/dist/init.js

@@ -6,7 +6,7 @@ import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, buildLoca
 import { healthPollTimeoutMs, healthTimeoutMessage, pollHealth, } from "./docker.js";
 import { reportPublicUrlProbe } from "./lifecycle.js";
 import { applyOptionalSettings, askOptionalSettings, derivePublicUrlOverride, } from "./optional-settings.js";
-import { buildFilesToWrite, readEnvPort, readEnvPublicUrl, writeFiles, } from "./scaffold.js";
+import { buildFilesToWrite, readEnvObsidianToken, readEnvPort, readEnvPublicUrl, stripEnvQuotedValues, writeFiles, } from "./scaffold.js";
 import { generateToken } from "./token.js";
 import { expandTilde, validateVaultPath } from "./vault.js";
 const DEFAULT_TARGET_DIR = "./vault-cortex";
@@ -27,15 +27,18 @@ const askMode = async (prompts) => {
     return isMode(selected) ? selected : "local";
 };
 /**
- * Offers to auto-capture the Obsidian Sync token via a Docker volume mount.
- * Returns the captured token string, or undefined when the user declines or
- * the capture fails (the caller falls back to a paste prompt).
+ * Offers to sign in to the Obsidian account and capture the Sync token.
+ * Returns the captured token string, or undefined when the user declines
+ * or the capture fails (the caller falls back to any token already in the
+ * on-disk .env, or shows get-sync-token guidance).
  */
-const offerSyncTokenCapture = async (prompts, docker) => {
+const offerSyncTokenCapture = async (prompts, fetchFn) => {
+    prompts.log("Your server needs an Obsidian Sync token to access your vault.\n" +
+        "You can sign in to your Obsidian account now to generate one.");
     const runNow = await prompts.confirm("Generate the token now?", true);
     if (!runNow)
         return undefined;
-    return captureObsidianToken({ docker, prompts }, "The token is captured automatically and stored in your .env — nothing to copy.");
+    return captureObsidianToken({ prompts, fetchFn });
 };
 /**
  * Asks for the vault path, recursing to re-prompt until it gets a usable
@@ -174,9 +177,11 @@ const offerDockerRun = async (params, deps) => {
     const startNow = await prompts.confirm("Start the server now?", true);
     if (!startNow)
         return "not-started";
+    const envFilePath = join(targetDir, ".env");
+    stripEnvQuotedValues(envFilePath);
     const containerStarted = docker.dockerRun({
         mode,
-        envFilePath: join(targetDir, ".env"),
+        envFilePath,
         port,
         vaultPath,
     });
@@ -285,12 +290,12 @@ const runLocalInit = async (flags, deps) => {
     return 0;
 };
 // Remote flow (VPS + Obsidian Sync): resolve target dir → PUBLIC_URL →
-// VAULT_NAME → Obsidian Sync token (optionally running the Obsidian login via
-// Docker) → optional E2E vault password → generate token → write .env →
-// optionally start → print connect instructions. Always interactive —
-// the sync-token step can't be defaulted.
+// VAULT_NAME → Obsidian Sync token (sign in via the Obsidian API) → optional
+// E2E vault password → generate token → write .env → optionally start → print
+// connect instructions. Always interactive — the sync-token step can't be
+// defaulted.
 const runRemoteInit = async (flags, deps) => {
-    const { prompts, docker } = deps;
+    const { prompts, fetchFn } = deps;
     // expandTilde before resolve: resolve() treats a leading `~` as a literal
     // path segment, so a quoted "~/path" would create a directory named "~".
     const targetDir = resolve(expandTilde(flags.dir ??
@@ -303,19 +308,17 @@ const runRemoteInit = async (flags, deps) => {
         return 0;
     const publicUrl = await askPublicUrl(prompts);
     const vaultName = await askVaultName(prompts);
-    // Auto-capture the Obsidian Sync token via a Docker volume mount when
-    // the daemon is reachable. Falls back to a paste prompt when capture
-    // fails or the user declines. Both non-running states stay silent here —
-    // the paste fallback is fully functional without Docker, and the start
-    // offer surfaces the differentiated runtime guidance later in the flow.
-    const capturedToken = docker.daemonStatus() === "running"
-        ? await offerSyncTokenCapture(prompts, docker)
-        : undefined;
-    // Masked prompt: the sync token is a credential and must not echo into
-    // the terminal or scrollback. An empty submission still means "fill in
-    // .env later" — clack's password prompt accepts blank input.
-    const obsidianAuthToken = capturedToken ??
-        (await prompts.password("Paste the Obsidian Sync token (leave blank to fill in .env later):")).trim();
+    // Sign in to Obsidian and capture the Sync token directly via the API.
+    // When the user declines or capture fails, fall back to any token already
+    // in the on-disk .env (a re-init over an existing deployment). Only show
+    // the "run get-sync-token later" guidance when neither source has a token.
+    const capturedToken = await offerSyncTokenCapture(prompts, fetchFn);
+    const existingEnvToken = readEnvObsidianToken(join(targetDir, ".env"));
+    const hasExistingToken = Boolean(capturedToken ?? existingEnvToken);
+    if (!hasExistingToken) {
+        prompts.log("No token yet — run this later to add it to your .env:\n" +
+            `  npx vault-cortex@latest get-sync-token --dir "${targetDir}"`);
+    }
     const usesEncryption = await prompts.confirm("Does your vault use end-to-end encryption?", false);
     const vaultPassword = usesEncryption
         ? await prompts.password("Vault encryption password:")
@@ -329,7 +332,7 @@ const runRemoteInit = async (flags, deps) => {
     const defaultEnvContent = buildRemoteEnv({
         mcpAuthToken: token,
         publicUrl,
-        obsidianAuthToken,
+        obsidianAuthToken: capturedToken ?? existingEnvToken,
         vaultName,
         vaultPassword,
     });
@@ -354,7 +357,7 @@ const runRemoteInit = async (flags, deps) => {
     const effectivePublicUrl = readEnvPublicUrl(join(targetDir, ".env")) ?? publicUrl;
     // Without the sync token the container can't start (init-check-auth fails
     // and s6 stops it), so only offer docker run when it was provided.
-    const startStatus = obsidianAuthToken === ""
+    const startStatus = !hasExistingToken
         ? "not-started"
         : await offerDockerRun({ targetDir, port, mode: "remote" }, deps);
     // The container check above hit localhost on this machine; the public URL
@@ -370,7 +373,7 @@ const runRemoteInit = async (flags, deps) => {
         token,
         publicUrl: effectivePublicUrl,
         startStatus,
-        obsidianTokenMissing: obsidianAuthToken === "",
+        obsidianTokenMissing: !hasExistingToken,
         tokenWritten,
     }));
     return 0;
@@ -392,11 +395,8 @@ export const runInit = async (flags, deps) => {
     prompts.intro("vault-cortex init");
     // Mode resolution: explicit --mode wins; --yes implies local; otherwise
     // ask, defaulting to local — it's the simpler activation path.
-    const mode = flags.mode !== undefined && isMode(flags.mode)
-        ? flags.mode
-        : flags.yes
-            ? "local"
-            : await askMode(prompts);
+    const flagMode = flags.mode && isMode(flags.mode) ? flags.mode : undefined;
+    const mode = flagMode ?? (flags.yes ? "local" : await askMode(prompts));
     const exitCode = mode === "local"
         ? await runLocalInit(flags, deps)
         : await runRemoteInit(flags, deps);

package/dist/lifecycle.js

@@ -1,7 +1,7 @@
 import { join, resolve } from "node:path";
 import { CONTAINER_NAME, healthPollTimeoutMs, healthTimeoutMessage, pollHealth, probeHealth, } from "./docker.js";
 import { buildDaemonNotRunningMessage, buildDockerNotInstalledMessage, } from "./messages.js";
-import { detectMode, hasEnvPublicUrl, readEnvPort, readEnvPublicUrl, readEnvVaultPath, } from "./scaffold.js";
+import { detectMode, hasEnvPublicUrl, readEnvPort, readEnvPublicUrl, readEnvVaultPath, stripEnvQuotedValues, } from "./scaffold.js";
 import { expandTilde } from "./vault.js";
 const DEFAULT_TARGET_DIR = "./vault-cortex";
 /**
@@ -110,6 +110,7 @@ export const recreateContainer = async (params, deps) => {
         prompts.error(`Could not remove the existing container — check: docker rm -f ${CONTAINER_NAME}`);
         return 1;
     }
+    stripEnvQuotedValues(deployment.envFilePath);
     prompts.log("Starting container...");
     const containerStarted = docker.dockerRun({
         mode: deployment.mode,

package/dist/main.js

@@ -44,7 +44,7 @@ export const run = async (version) => {
         }),
         runGetSyncToken: (flags) => runGetSyncToken(flags, {
             prompts: createPrompts(),
-            docker: createDockerRunner(),
+            fetchFn: fetch,
         }),
     });
     await program.parseAsync();

package/dist/messages.js

@@ -33,7 +33,7 @@ const dockerInstallLine = (platform) => {
 /**
  * "No runtime at all" guidance — distinct from the daemon-stopped message so
  * the user isn't told to start something that isn't installed. platform is a
- * defaulted param (mirroring buildObsidianLoginArgs) so each branch stays
+ * defaulted param so each branch stays
  * testable; `nextStep` is appended verbatim, as in
  * buildDaemonNotRunningMessage.
  */
@@ -126,11 +126,10 @@ const updateGuidance = (targetDir) => `Update to the latest release:
 export const buildLocalConnectMessage = (params) => {
     const { targetDir, token, startStatus, port, tokenWritten } = params;
     const baseUrl = `http://localhost:${port}`;
-    const startLine = startStatus === "running"
-        ? "The server is running."
-        : startStatus === "starting"
-            ? startingInBackgroundLine()
-            : startServerLine(targetDir);
+    const nonRunningLine = startStatus === "starting"
+        ? startingInBackgroundLine()
+        : startServerLine(targetDir);
+    const startLine = startStatus === "running" ? "The server is running." : nonRunningLine;
     const tokenLine = tokenBlock({ targetDir, token, tokenWritten });
     // Once the server is confirmed up, the smoke test is dropped — the CLI just
     // verified this exact URL, so re-printing it reads as leftover homework.

package/dist/program.js

@@ -61,7 +61,7 @@ export const buildProgram = (options) => {
     });
     program
         .command("get-sync-token")
-        .description("Generate an Obsidian Sync auth token via Docker and print it or write it to .env")
+        .description("Sign in to your Obsidian account and print the Sync auth token, or write it to .env")
         .option("--dir <path>", "directory containing .env to update with the token")
         .action(async (flags) => {
         process.exitCode = await options.runGetSyncToken(flags);

package/dist/scaffold.js

@@ -2,8 +2,8 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "
 import { join } from "node:path";
 /** Default host port — matches the container's internal port. */
 export const DEFAULT_PORT = 8000;
-/** Matches an active (uncommented) PORT line in a .env file. */
-const ENV_PORT_LINE = /^PORT=(\d+)\s*$/m;
+/** Matches an active (uncommented) PORT line, with optional surrounding quotes. */
+const ENV_PORT_LINE = /^PORT=["']?(\d+)["']?\s*$/m;
 /** Matches an active (uncommented) VAULT_PATH line in a .env file. */
 const ENV_VAULT_PATH_LINE = /^VAULT_PATH=(.+)\s*$/m;
 /** Matches an active (uncommented) PUBLIC_URL line. */
@@ -12,6 +12,17 @@ const ENV_PUBLIC_URL_LINE = /^PUBLIC_URL=/m;
 const ENV_PUBLIC_URL_VALUE_LINE = /^PUBLIC_URL=(.+)\s*$/m;
 /** Matches an active (uncommented) OBSIDIAN_AUTH_TOKEN line. */
 const OBSIDIAN_AUTH_TOKEN_LINE = /^OBSIDIAN_AUTH_TOKEN=/m;
+/** Matches an env line whose value is wrapped in matching quotes. */
+const QUOTED_ENV_VALUE = /^([A-Za-z_][A-Za-z0-9_]*=)(["'])(.*)\2(\s*)$/gm;
+/**
+ * Strips matching surrounding quotes from a value — `"foo"` → `foo`,
+ * `'bar'` → `bar`, `unquoted` → `unquoted`. Only strips when the
+ * opening and closing quote characters match.
+ */
+const stripSurroundingQuotes = (value) => {
+    const quoteMatch = /^(["'])(.*)\1$/.exec(value);
+    return quoteMatch ? quoteMatch[2] : value;
+};
 export const buildFilesToWrite = (envContent) => [
     // .env holds the bearer token (and possibly a vault password) — owner-only.
     { name: ".env", content: envContent, mode: 0o600 },
@@ -36,7 +47,8 @@ export const readEnvVaultPath = (envFilePath) => {
     if (!existsSync(envFilePath))
         return undefined;
     const match = ENV_VAULT_PATH_LINE.exec(readFileSync(envFilePath, "utf8"));
-    return match?.[1].trim();
+    const rawValue = match?.[1].trim();
+    return rawValue ? stripSurroundingQuotes(rawValue) : undefined;
 };
 /**
  * Returns true when the .env file has an active (uncommented) PUBLIC_URL line.
@@ -63,11 +75,12 @@ export const readEnvPublicUrl = (envFilePath) => {
     const match = ENV_PUBLIC_URL_VALUE_LINE.exec(readFileSync(envFilePath, "utf8"));
     // A whitespace-only line matches the regex and trims to "" — normalize to
     // undefined so the non-empty contract holds ("" is never a legitimate URL).
-    const publicUrlValue = match?.[1].trim();
+    const rawValue = match?.[1].trim();
+    const unquotedValue = rawValue ? stripSurroundingQuotes(rawValue) : undefined;
     // Strip trailing slashes (mirroring askPublicUrl's prompt-side
     // normalization): consumers append paths to this base, and a hand-edited
     // `https://host/` would otherwise print broken `//mcp` connect URLs.
-    const normalizedPublicUrl = publicUrlValue?.replace(/\/+$/, "");
+    const normalizedPublicUrl = unquotedValue?.replace(/\/+$/, "");
     return normalizedPublicUrl || undefined;
 };
 /**
@@ -100,6 +113,36 @@ export const patchEnvObsidianToken = (envFilePath, token) => {
     writeFileSync(envFilePath, patched);
     return true;
 };
+/**
+ * Reads the OBSIDIAN_AUTH_TOKEN value from an existing .env file. Returns
+ * undefined when the file is missing, has no active line, or the value is
+ * empty — an empty `OBSIDIAN_AUTH_TOKEN=` line is not a valid token.
+ */
+export const readEnvObsidianToken = (envFilePath) => {
+    if (!existsSync(envFilePath))
+        return undefined;
+    const match = /^OBSIDIAN_AUTH_TOKEN=(.+)$/m.exec(readFileSync(envFilePath, "utf8"));
+    return match?.[1].trim() || undefined;
+};
+/**
+ * Strips surrounding quotes from env values in the file. `docker run
+ * --env-file` passes quotes literally (`VAULT_NAME="My Vault"` becomes
+ * the value `"My Vault"` with embedded quotes), while Compose strips
+ * them. Removing quotes makes the file work correctly for both paths.
+ * Returns true when the file was modified.
+ */
+export const stripEnvQuotedValues = (envFilePath) => {
+    if (!existsSync(envFilePath))
+        return false;
+    const content = readFileSync(envFilePath, "utf8");
+    // Reset lastIndex — the /g flag makes the regex stateful.
+    QUOTED_ENV_VALUE.lastIndex = 0;
+    const sanitized = content.replace(QUOTED_ENV_VALUE, "$1$3$4");
+    if (sanitized === content)
+        return false;
+    writeFileSync(envFilePath, sanitized);
+    return true;
+};
 /**
  * Writes the files into targetDir (created if missing). Existing files
  * are never overwritten silently: identical content is skipped, and differing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-cortex",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Set up a Vault Cortex MCP server for your Obsidian vault in one command: npx vault-cortex@latest init",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,6 @@
     "obsidian-vault",
     "obsidian-sync",
     "ai-agents",
-    "ai-memory",
     "ai-memory-system",
     "knowledge-base",
     "note-taking",
@@ -42,7 +41,7 @@
     "task-management",
     "semantic-search",
     "attachments",
-    "pdf",
+    "one-click-deploy",
     "self-hosted",
     "docker",
     "claude",